Reverse engineering and penetration testing

As we have successfully reverse engineered an APK to the Java source code, it is now important to understand why reverse engineering is very important and might be required during penetration testing. Often in a penetration testing engagement (black box), all that is available to the penetration tester is the name of the application. The penetration tester downloads the application on a device and extracts the APK.

There might be several cases when it is not evident how certain functions of the application are implemented just by using the app. In order to find vulnerabilities in the application, it is required to understand how it works. Reverse engineering helps to answer some of these questions.

Let's take an example. Imagine you are given a banking application to test (penetration testing). While using the application, you notice that the application implements a security control that encrypts all the user-submitted data values...